Well it happened a while back, remember? The French researcher Guillaume Tena who got in trouble for breaching French copywrite laws by decompiling some software.
Now people are generally starting to worry about disclosing vulnerabilities through any channels, does there need to be some kind of anonymous PGP key based system for vulnerability disclosure? So people can do it without fear of getting sued?
The CERIAS weblog examines the risks associated with reporting vulnerabilities. In the end, he advises that the risks (in one situation, at least) were almost not worth the trouble, and gives advice on how to stay out of trouble. Is it worth it to report vulnerabilities despite the risks, or is the chilling effect demonstrated here too much?
A typical difficulty encountered by vulnerability researchers is that administrators or programmers often deny that a problem is exploitable or is of any consequence, and request a proof. This got Eric McCarty in trouble & the proof is automatically a proof that you breached the law, and can be used to prosecute you!
It’s an interesting point when it comes to public disclosure, unless you have permission, how do you prove you’ve found a vulnerability without getting in trouble?
HD Moore also discussed this recently with:
- PayPal Remote Code Execution Vulnerability Patched
- Fortinet SSH Backdoor Found In Firewalls
- Facebook Disabled Flash For Video Finally
- 3Com’s TippingPoint Finds New IE Vulnerabilities
- Sandcat by Syhunt – Web Server & Application Vulnerability Scanner
- What Responsibility do Anti-Spyware Researchers Have?
Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 233,110 views
- AJAX: Is your application secure enough? - 119,814 views
- eEye Launches 0-Day Exploit Tracker - 85,360 views